CVE-2026-100859: Heym before 0.0.106 Credential Exfiltration via URL Override

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-27 · updated 2026-09-30
Weakness: CWE-918

Description

Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators with shared credential access to exfiltrate the credential owner's secret. Attackers can override the destination URL in the config parameter to cause the server to send decrypted authentication secrets to attacker-controlled endpoints.

Affected products

heymrun heym: before 0.0.106 — fixed in 0.0.106

How to fix

Upgrade to a fixed version: heymrun heym 0.0.106. Check the vendor advisory for mitigations.

References

https://github.com/heymrun/heym/security/advisories/GHSA-39qx-wp7x-69rq
https://www.vulncheck.com/advisories/heym-before-0.0.106-credential-exfiltration-via-url-override

Get alerted when CVE-2026-100859 or the next vulnerability affects your stack